Authorizing an array of ID's with the Pundit gem

Question

I have a multiple select box for a has_many association. The params come in as:

foo_ids: ["1", "2", "3"]

Using strong parameters, I do not permit this attribute because I would like to authorize it myself so people cannot just put whatever they want in it.

def update
  bar.foos = authorized_foos
  bar.update(baz_params)
  respond_with bar
end

private

  def authorized_foos
    foos = Foo.find(params[:baz][:foo_ids])
    foos.each do |foo|
      authorize foo, :manage?
    end
  end

This approach is going to force me to find all of the foos, loop through them, and authorize each one individually. Is there an easier way to manage has_many authorization, preferably with the Pundit gem?

Answer 1

The simplest way to do this is looping. Iterate through each user from the users' array and authorize each and every user. For example,

users_id_array = [1,2,3,4,5,6]

private

  def authorized_users
  users = User.find(params[:group][:user_ids])
  users.each { |u| authorize u, :manage? }
  ...
end

So this is the very basic and simplest answer.